constant-time-analysis

Detect timing side-channel vulnerabilities in cryptographic assembly or bytecode.

Updated Feb 26, 2026

Search Tags:#code analysis #security #vulnerability #cryptography #timing attack #side-channel

Ready to run

npx skills add https://github.com/keremtoker468-dotcom/restoran --skill constant-time-analysis-keremtoker468-dotcom

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: constant-time-analysis
Source: https://github.com/keremtoker468-dotcom/restoran/tree/main/.claude/skills/constant-time-analysis
Command: npx skills add https://github.com/keremtoker468-dotcom/restoran --skill constant-time-analysis-keremtoker468-dotcom

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps developers identify and fix timing side-channel vulnerabilities in cryptographic code, preventing secret data leaks through execution time variations.

Core Features & Use Cases

Vulnerability Detection: Analyzes compiled code (assembly/bytecode) for dangerous instructions like division or secret-dependent branches.
Cross-Language Support: Works with C, C++, Go, Rust, PHP, JavaScript, TypeScript, Python, and Ruby.
Use Case: You've implemented a new encryption function and want to ensure it's resistant to timing attacks. This Skill will scan the code and highlight any potential weaknesses.

Quick Start

Use the constant-time-analysis skill to check the file 'crypto.c' for timing vulnerabilities.

Frequently Asked Questions about constant-time-analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I detect timing side-channel vulnerabilities in cryptographic code?▼

To detect timing side-channel vulnerabilities, you can analyze compiled assembly or bytecode output for dangerous instructions like division or secret-dependent branches. This Skill scans compiled cryptographic code to highlight execution time variations that leak secret data.

Does constant-time analysis work with Go, Rust, and Python code?▼

Constant-time analysis works with C, C++, Go, Rust, PHP, JavaScript, TypeScript, Python, and Ruby. It analyzes the compiled assembly or bytecode output across these languages to identify timing vulnerabilities in cryptographic implementations.

What is a timing attack and how do dangerous instructions cause execution time variations?▼

A timing attack exploits execution time variations to leak secret data from cryptographic operations. Dangerous instructions like division or secret-dependent branches in compiled assembly or bytecode cause measurable time differences that attackers can observe to recover sensitive information.

How do I integrate timing vulnerability scanning into a CI pipeline?▼

You can integrate timing vulnerability scanning into a CI pipeline by running the analysis on compiled code during automated builds. This Skill checks assembly or bytecode output for dangerous instructions and guides developers toward constant-time fixes before deployment.

Can I analyze JIT-compiled JavaScript and TypeScript bytecode for timing attacks?▼

Yes, you can analyze JavaScript and TypeScript bytecode for timing attacks alongside C, C++, Go, Rust, PHP, Python, and Ruby. The Skill examines compiled bytecode output to detect dangerous instructions that create secret-dependent execution time variations.

What are the limitations of static assembly analysis for detecting timing side-channels?▼

Static assembly analysis for timing side-channels focuses on detecting dangerous instructions like division and secret-dependent branches in compiled output. It may not capture all runtime or environment-specific timing variations and requires compiled code rather than analyzing source-level logic directly.